How to check if a crypto address is a scam
Seven quick checks that show whether a crypto address belongs to a scammer: scam reports, address history, AML and sanctions, lookalikes and fake tokens.
By Web3 Copilot team6 min read
To check if a crypto address is a scam, search it in public scam reports, open its history on a block explorer, run an AML and sanctions check, and compare it character by character with the address you expect. No single check proves an address is safe. Scam addresses are cheap to create and often have no reports yet, so the pattern of activity matters as much as any database result.
The stakes are high because crypto transfers are final. In its 2025 report, the FBI's Internet Crime Complaint Center counted $11.4 billion in crypto-related fraud losses reported by Americans, $7.2 billion of it from fake investment schemes. Almost all of that money was sent by the victims themselves.
The seven checks at a glance
- Search the address in scam report databases.
- Read its on-chain history for red flags.
- Run an AML and sanctions check.
- Make sure it is not a lookalike of an address you know.
- If it is a token, check the token contract.
- Check the story that came with the address.
- For a large amount, send a small test first.
1. Search the address in scam report databases
Start with what other people have already reported:
- Chainabuse. Chainabuse is a free public database of scam reports run by TRM Labs. Paste the address and read any reports attached to it.
- Explorer labels. Block explorers mark some known scam and phishing addresses. On Etherscan, for example, look for a "Phish/Hack" tag next to the address.
- A plain web search. Search the full address in quotes, and also on X and Reddit. Victims often post scam addresses there before they reach any database.
A report is a strong signal. No report means very little: many scam addresses are used for a few days and then abandoned.
2. Read the address history for red flags
Open the address on a block explorer or in a wallet analyzer and look at how it has been used. These patterns are typical for scam wallets:
| What you see | Why it is a red flag |
|---|---|
| The address is a few days old, but you were told it is an established business wallet | The story does not match the chain |
| Many small payments from different wallets, then everything moves out within hours | Typical for a wallet that collects money from victims |
| Funds leave almost immediately through several new addresses | Typical for laundering, not for a normal business |
| Incoming funds from a mixer or a flagged address | The money's origin is hidden or already linked to crime |
| It sends tiny or zero-value transfers to hundreds of wallets | Typical for an address poisoning bot |
A wallet analyzer puts the age, the number of incoming payments and the latest transfers side by side. Demo data in the real Web3 Copilot interface.
One red flag is a reason to slow down. Two or more, combined with pressure to pay quickly, is a reason to stop.
3. Run an AML and sanctions check
An AML check looks at where an address's money came from and where it went. It flags links to scams, stolen funds, darknet markets, mixers and sanctioned entities. A sanctions check looks for the address itself on the U.S. Treasury's OFAC list.
Both only know about addresses someone has already identified, so they catch known bad actors best. Our guides explain how to read an AML check and what an OFAC result means.
4. Make sure it is not a lookalike
Some scams do not need a fake story. Attackers generate an address that starts and ends with the same characters as one you use, then plant it in your transaction history. If you copy it from there, you pay the attacker.
Compare the full address with the one from the recipient's own source, including the middle characters. If it came from your history, treat it as untrusted. We explain the trick in detail in Address poisoning: how the scam works.
5. If it is a token, check the token contract
Anyone can create a token called "USDT" or "Tether USD" with the real logo. Fake tokens are used to make a payment look received when nothing of value arrived.
If someone sent you tokens, open the transaction and check the token's contract address. Compare it with the contract listed on the issuer's own website. For USDT, Tether publishes its official contracts on tether.to. Any other contract is not real USDT. Our article on flash USDT shows how this trick is used against sellers.
6. Check the story that came with the address
The address is often the least suspicious part of a scam. The story around it gives more away. Be very careful if:
- an investment platform promises fixed daily returns,
- you are asked to pay a fee, tax or "unlock deposit" before you can withdraw,
- a support agent contacts you first, in a direct message,
- someone you met online moves the conversation to Telegram or WhatsApp and then talks about crypto,
- a "recovery service" offers to get back money you already lost, for an upfront fee.
If the story has any of these elements, a clean address check does not make the deal safe.
7. For a large amount, send a small test first
A test transfer protects you from typos, wrong networks and wrong memo fields. It does not protect you from a scam: a scammer will happily receive your test and confirm it. Use it together with the checks above, not instead of them.
What does "no reports found" mean?
It means the sources you checked have no record of this address. That is useful, but it is not proof of safety. New scam addresses appear every day, and most of them are never reported. Treat a clean result as one input and weigh it against the history and the story.
How Web3 Copilot helps
Web3 Copilot is a free Chrome extension that covers checks 2 and 3 in one report:
- Paste an address, or just open it on Etherscan, Tronscan, Solana Explorer, Tonviewer or another supported explorer. The extension detects the address and the network.
- Risk Score from 0 to 100, where higher means riskier, with the main reasons and a confidence level.
- AML and sanctions card that shows each source separately, so you can see what was checked and what was not.
- Balances, tokens and recent activity on 14 networks, including Ethereum, TRON, Solana, Bitcoin and TON.
- AI chat to ask follow-up questions about the address in plain language.
A high risk score always comes with its reasons: here, most incoming money came from scam wallets. Demo data in the real Web3 Copilot interface.
When there is too little data for a fair score, the report says "Limited assessment" instead of showing a number, so a gap in the data never looks like a safe result.
It never asks you to connect a wallet, sign anything or share a seed phrase. Checks 1, 4, 5 and 6 still depend on you, and the checklist above stays the same.
Already sent money to a scam address?
Recovery is rare, but acting fast improves the odds:
- Contact the exchange that the funds move to next. Exchanges can freeze stolen funds that arrive on their platform if they get a report quickly.
- File a report with the police and, in the U.S., with the FBI at ic3.gov. Add the address and transaction IDs.
- Report the address on Chainabuse so the next person sees it.
- Ignore anyone who offers to recover your funds for an upfront fee. These "recovery services" are a well-known second scam.